PT-2023-3171 · Zyxel · Zyxel Nas540+2

Andrej Zaujec + 1 · Publicado 2023-06-19 · Atualizado 2023-09-29 · CVE-2023-27992

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zyxel NAS326 versions prior to V5.21(AAZF.14)C0 Zyxel NAS540 versions prior to V5.21(AATB.11)C0 Zyxel NAS542 versions prior to V5.21(ABAG.11)C0

Description The pre-authentication command injection issue in Zyxel NAS devices could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request. This could enable an attacker to run arbitrary commands on affected systems.

Recommendations For Zyxel NAS326 versions prior to V5.21(AAZF.14)C0, update to version V5.21(AAZF.14)C0 or later. For Zyxel NAS540 versions prior to V5.21(AATB.11)C0, update to version V5.21(AATB.11)C0 or later. For Zyxel NAS542 versions prior to V5.21(ABAG.11)C0, update to version V5.21(ABAG.11)C0 or later. As a temporary workaround, consider restricting access to the affected devices until a patch is applied.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-03280

CVE-2023-27992

Produtos afetados

Zyxel Nas326

Zyxel Nas540

Zyxel Nas542

Referências · 10

• https://zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-pre-authentication-command-injection-vulnerability-in-nas-products · Aviso do Fabricante, Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27992 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27992 · Nota
• https://t.me/pentestingnews/36995 · Publicação no Telegram
• https://t.me/thehackernews/3503 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-03280 · Nota de Segurança
• https://twitter.com/clovernetics/status/1707727686070600089 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-27992 · Nota de Segurança
• https://t.me/pentestingnews/37041 · Publicação no Telegram
• https://t.me/cvenotify/53128 · Publicação no Telegram